{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:341854ca-923b-54be-9d63-661b7be5ac72", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "spring-security-ldap", "purl": "pkg:maven/org.springframework.security/spring-security-ldap@5.7.7-tuxcare.1", "type": "library", "group": "org.springframework.security", "bom-ref": "pkg:maven/org.springframework.security/spring-security-ldap@5.7.7-tuxcare.1", "version": "5.7.7-tuxcare.1", "pedigree": { "ancestors": [ { "name": "spring-security-ldap", "purl": "pkg:maven/org.springframework.security/spring-security-ldap@5.7.7", "type": "library", "group": "org.springframework.security", "version": "5.7.7" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2010-3700", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-ldap@5.7.7-tuxcare.1" } ], "bom-ref": "urn:uuid:c21bc37c-795f-57ea-82c4-710c5e921aed", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2010-3700 affects version 5.7.7-tuxcare.1 of org.springframework.security:spring-security-ldap." } }, { "id": "CVE-2011-2731", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-ldap@5.7.7-tuxcare.1" } ], "bom-ref": "urn:uuid:ec6c632b-8900-52c8-be0c-3373d65f07e5", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-2731 affects version 5.7.7-tuxcare.1 of org.springframework.security:spring-security-ldap." } }, { "id": "CVE-2011-2732", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-ldap@5.7.7-tuxcare.1" } ], "bom-ref": "urn:uuid:fd646da0-0a8b-5932-8ced-143031e0ef12", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-2732 affects version 5.7.7-tuxcare.1 of org.springframework.security:spring-security-ldap." } }, { "id": "CVE-2011-2894", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-ldap@5.7.7-tuxcare.1" } ], "bom-ref": "urn:uuid:d5f79871-34fc-5f88-9643-4e8477c08025", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-2894 affects version 5.7.7-tuxcare.1 of org.springframework.security:spring-security-ldap." } }, { "id": "CVE-2012-5055", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-ldap@5.7.7-tuxcare.1" } ], "bom-ref": "urn:uuid:c6eb1b4d-cfc6-5a9e-ad92-90071a774fdb", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2012-5055 affects version 5.7.7-tuxcare.1 of org.springframework.security:spring-security-ldap." } }, { "id": "CVE-2014-0097", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-ldap@5.7.7-tuxcare.1" } ], "bom-ref": "urn:uuid:956cdcd0-f96f-54b2-9c8a-f3845a9bfc86", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2014-0097 affects version 5.7.7-tuxcare.1 of org.springframework.security:spring-security-ldap." } }, { "id": "CVE-2014-3527", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-ldap@5.7.7-tuxcare.1" } ], "bom-ref": "urn:uuid:acfd7b6b-b77a-54cf-b9c3-3ae08171b97a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2014-3527 affects version 5.7.7-tuxcare.1 of org.springframework.security:spring-security-ldap." } }, { "id": "CVE-2016-5007", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-ldap@5.7.7-tuxcare.1" } ], "bom-ref": "urn:uuid:f941d1fc-faa8-509b-ad83-7dbb7ddb2f27", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-5007 affects version 5.7.7-tuxcare.1 of org.springframework.security:spring-security-ldap." } }, { "id": "CVE-2016-9879", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-ldap@5.7.7-tuxcare.1" } ], "bom-ref": "urn:uuid:e4ad01db-dfd7-5980-ba9a-451fef3ae130", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-9879 affects version 5.7.7-tuxcare.1 of org.springframework.security:spring-security-ldap." } }, { "id": "CVE-2017-4995", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-ldap@5.7.7-tuxcare.1" } ], "bom-ref": "urn:uuid:a50f7e34-62fa-5809-bc3e-63f42c7748d6", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2017-4995 affects version 5.7.7-tuxcare.1 of org.springframework.security:spring-security-ldap." } }, { "id": "CVE-2018-1199", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-ldap@5.7.7-tuxcare.1" } ], "bom-ref": "urn:uuid:30ccd721-615b-5ce5-a811-e721b5bfb671", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1199 affects version 5.7.7-tuxcare.1 of org.springframework.security:spring-security-ldap." } }, { "id": "CVE-2018-15801", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-ldap@5.7.7-tuxcare.1" } ], "bom-ref": "urn:uuid:ebcaecee-bdbd-599f-9ed1-262f75a5921c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-15801 affects version 5.7.7-tuxcare.1 of org.springframework.security:spring-security-ldap." } }, { "id": "CVE-2019-11272", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-ldap@5.7.7-tuxcare.1" } ], "bom-ref": "urn:uuid:dc6973d6-15bb-5b08-aacf-a767340afb9b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2019-11272 affects version 5.7.7-tuxcare.1 of org.springframework.security:spring-security-ldap." } }, { "id": "CVE-2019-3795", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-ldap@5.7.7-tuxcare.1" } ], "bom-ref": "urn:uuid:c51a3979-f476-5142-835a-fd7845c0d215", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2019-3795 affects version 5.7.7-tuxcare.1 of org.springframework.security:spring-security-ldap." } }, { "id": "CVE-2020-5407", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-ldap@5.7.7-tuxcare.1" } ], "bom-ref": "urn:uuid:fc11f8cb-e249-5218-86a8-4f3625eb690e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-5407 affects version 5.7.7-tuxcare.1 of org.springframework.security:spring-security-ldap." } }, { "id": "CVE-2020-5408", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-ldap@5.7.7-tuxcare.1" } ], "bom-ref": "urn:uuid:a4748341-f9cc-5879-84db-f38d94c1613c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-5408 affects version 5.7.7-tuxcare.1 of org.springframework.security:spring-security-ldap." } }, { "id": "CVE-2021-22119", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-ldap@5.7.7-tuxcare.1" } ], "bom-ref": "urn:uuid:643c4590-abb5-5320-a6a3-39021a7211e6", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22119 affects version 5.7.7-tuxcare.1 of org.springframework.security:spring-security-ldap." } }, { "id": "CVE-2022-22976", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-ldap@5.7.7-tuxcare.1" } ], "bom-ref": "urn:uuid:5b756f7f-a928-544f-ac8d-4c6142f1f084", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-22976 affects version 5.7.7-tuxcare.1 of org.springframework.security:spring-security-ldap." } }, { "id": "CVE-2022-22978", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-ldap@5.7.7-tuxcare.1" } ], "bom-ref": "urn:uuid:db3e4a12-562e-5d2c-b77d-d286f3f36cc1", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-22978 affects version 5.7.7-tuxcare.1 of org.springframework.security:spring-security-ldap." } }, { "id": "CVE-2022-31692", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-ldap@5.7.7-tuxcare.1" } ], "bom-ref": "urn:uuid:80089309-4f7b-51be-b752-a9a25cdbf2f4", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-31692 affects version 5.7.7-tuxcare.1 of org.springframework.security:spring-security-ldap." } }, { "id": "CVE-2023-20862", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-ldap@5.7.7-tuxcare.1" } ], "bom-ref": "urn:uuid:8b362809-ed90-5ed3-a85d-79c4e9daaccd", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-20862 affects version 5.7.7-tuxcare.1 of org.springframework.security:spring-security-ldap." } }, { "id": "CVE-2024-22234", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-ldap@5.7.7-tuxcare.1" } ], "bom-ref": "urn:uuid:fe76b276-8529-5cb1-a9fc-2a23eb0c2bec", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22234 affects version 5.7.7-tuxcare.1 of org.springframework.security:spring-security-ldap." } }, { "id": "CVE-2024-22257", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-ldap@5.7.7-tuxcare.1" } ], "bom-ref": "urn:uuid:506cbae3-b393-5b5f-a273-86b33d07fbbd", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22257 is fixed in version 5.7.7-tuxcare.1 of org.springframework.security:spring-security-ldap." } }, { "id": "CVE-2024-38810", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-ldap@5.7.7-tuxcare.1" } ], "bom-ref": "urn:uuid:d2ea5560-2d70-528c-a8dd-4e06e9b14cf3", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-38810 affects version 5.7.7-tuxcare.1 of org.springframework.security:spring-security-ldap." } }, { "id": "CVE-2024-38827", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-ldap@5.7.7-tuxcare.1" } ], "bom-ref": "urn:uuid:ab66c21d-43c1-5c79-a2d3-76b85c731af0", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38827 is fixed in version 5.7.7-tuxcare.1 of org.springframework.security:spring-security-ldap." } }, { "id": "CVE-2025-22223", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-ldap@5.7.7-tuxcare.1" } ], "bom-ref": "urn:uuid:1b584bbc-a260-568c-b899-cd816a55abe4", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-22223 affects version 5.7.7-tuxcare.1 of org.springframework.security:spring-security-ldap." } }, { "id": "CVE-2025-22228", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-ldap@5.7.7-tuxcare.1" } ], "bom-ref": "urn:uuid:99b330d4-1ccd-593e-8213-bbfff9d2563d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-22228 is fixed in version 5.7.7-tuxcare.1 of org.springframework.security:spring-security-ldap." } }, { "id": "CVE-2025-22234", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-ldap@5.7.7-tuxcare.1" } ], "bom-ref": "urn:uuid:1943ca46-b452-5411-bf21-9368d57e3151", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2025-22234 does not affect version 5.7.7-tuxcare.1 of org.springframework.security:spring-security-ldap. not_affected \u2014 Spring Security 5.7.7 is not affected by CVE-2025-22234. This CVE is a secondary vulnerability introduced by the fix for CVE-2025-22228, which added a password length check to BCrypt that broke timing attack mitigation. The target version (5.7.7) never received the CVE-2025-22228 fix, and therefore does not contain the problematic code that causes CVE-2025-22234. The timing attack mitigation in...", "justification": "code_not_present" } }, { "id": "CVE-2025-41232", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-ldap@5.7.7-tuxcare.1" } ], "bom-ref": "urn:uuid:198aa642-62a8-5fc1-8770-e334194a7b29", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2025-41232 does not affect version 5.7.7-tuxcare.1 of org.springframework.security:spring-security-ldap. CVE-2025-41232 is in UniqueSecurityAnnotationScanner, which Spring Security 6.4 added for method security in AspectJ mode. Spring Security 5.7.7 does not contain that scanner, so it is not affected.", "justification": "code_not_present" } }, { "id": "CVE-2025-41248", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-ldap@5.7.7-tuxcare.1" } ], "bom-ref": "urn:uuid:884b019b-7a33-5eb4-a107-c5d6bf86b94a", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2025-41248 does not affect version 5.7.7-tuxcare.1 of org.springframework.security:spring-security-ldap. Spring Security 5.7.7 has no generic-type annotation matching of its own: method security looks annotations up through Spring Framework's annotation utilities, so the CVE-2025-41248 code is not present. The equivalent issue in Spring Framework is tracked as CVE-2025-41249.", "justification": "code_not_present" } }, { "id": "CVE-2026-22746", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-ldap@5.7.7-tuxcare.1" } ], "bom-ref": "urn:uuid:265ca517-7b51-5851-85a2-d9e82059ada8", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22746 is fixed in version 5.7.7-tuxcare.1 of org.springframework.security:spring-security-ldap." } }, { "id": "CVE-2026-22751", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-ldap@5.7.7-tuxcare.1" } ], "bom-ref": "urn:uuid:1b2d2b97-a299-54b5-baf1-b1db4e1feb14", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-22751 does not affect version 5.7.7-tuxcare.1 of org.springframework.security:spring-security-ldap. not_affected \u2014 Spring Security 5.7.7 is not affected by CVE-2026-22751 because the vulnerable component (JdbcOneTimeTokenService) does not exist in this version. The One-Time Token (OTT) authentication feature was introduced in Spring Security 6.4.0, and version 5.7.7 predates this feature entirely. Comprehensive searches across the codebase found no JdbcOneTimeTokenService class, no OneTimeToken-related code...", "justification": "code_not_present" } }, { "id": "CVE-2026-47842", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-ldap@5.7.7-tuxcare.1" } ], "bom-ref": "urn:uuid:5776f518-d2ec-503e-b979-7fe7a73ac4d5", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-47842 affects version 5.7.7-tuxcare.1 of org.springframework.security:spring-security-ldap, and is fixed in 5.7.7-tuxcare.2." } }, { "id": "CVE-2026-59270", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-ldap@5.7.7-tuxcare.1" } ], "bom-ref": "urn:uuid:18cac413-24ed-5f39-83db-5eaa4de9a09d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-59270 affects version 5.7.7-tuxcare.1 of org.springframework.security:spring-security-ldap, and is fixed in 5.7.7-tuxcare.2." } }, { "id": "CVE-2026-59276", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-ldap@5.7.7-tuxcare.1" } ], "bom-ref": "urn:uuid:64d9ef5a-da17-5e25-a965-26e306ebb93e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-59276 affects version 5.7.7-tuxcare.1 of org.springframework.security:spring-security-ldap, and is fixed in 5.7.7-tuxcare.2." } }, { "id": "CVE-2026-59277", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-ldap@5.7.7-tuxcare.1" } ], "bom-ref": "urn:uuid:58b8634e-0c4c-53a6-a1c4-9f9b5c8fb109", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-59277 does not affect version 5.7.7-tuxcare.1 of org.springframework.security:spring-security-ldap. not_affected \u2014 Spring Security 5.7.7 is not affected by CVE-2026-59277. The vulnerable component, the InetAddressMatchers utility class with matchInternal()/matchExternal() builders for classifying IP addresses as internal or external networks, does not exist in this version. The CVE describes a misclassification vulnerability where 0.0.0.0 and :: are incorrectly treated as external addresses. However, versio...", "justification": "code_not_reachable" } } ], "dependencies": [ { "ref": "pkg:maven/org.springframework.security/spring-security-ldap@5.7.7-tuxcare.1" } ] }